Mobile Content Hosting Infrastructure in China: A View from a Cellular ISP. Zhenhua Li Chunjing Han Gaogang Xie

Transcription

1 Mobile Content Hosting Infrastructure in China: A View from a Cellular ISP Zhenyu Li Donghui Yang Zhenhua Li Chunjing Han Gaogang Xie

2 Continuous increase of mobile data CISCO projected: the mobile data will increase7-fold by 2021 The increase is largely due to rich content being available Video traffic will be 78% by 2021 The Internet is indeed a content network Content request Data / content PAM 2018, Berlin 2

3 Content hosting and delivery service outsourcing content delivery Cloud Questions: network footprint? traffic locality? 3

4 Why China? The largest Internet in a single country Over 800 million video users unique local regulations and network policies Network is planned: very few ASes seen outside The ICP regulation: Akamai could not deploy replica servers in mainland China Heavily censored visible web access. How about invisible web access (a.k.a trackers)? Google is not accessible, but how about doubleclick? 4

5 Passive DNS Data timestamp, domain name, response IP list LDNS Logs were collected from all recursive DNS resolvers of a major Chinese cellular ISP 2 days, ~55 billion logs Response IP list: ~50% one single IP The first one was taken as the one that the hostname was mapped to PAM 2018, Berlin 5

6 Passive DNS Data Data Preprocessing IP to ASN using Team Cymru Aggregation IPs to /24 prefix FQDN (Full Qualified Domain Names) to their second level domains (SLDs) to save analysis time Invisible web access: identification of tracking domains using Easylist + EasylistChina. Ethical issues No personal ID (client IP addresses are not available) Such datasets are maintained by ISPs for maintenance purpose PAM 2018, Berlin 6

7 Metrics CDP: content delivery potential Fraction of domains that an AS can serve CMI: content monopoly index the extent to which an AS hosts content that others do not have AS1 AS2 CDP=4/6 CMI=1/4*(1/2+1+1/2+1/2)=5/8 AS3 S i : # of domains that can be served by this AS m j : # of ASes that can serve this domain CDP=2/6 CMI=1/2*(1+1)=1 Ager, B., Muhlbauer, W., Smaragdakis, G., Uhlig, PAM 2018, S.: Web Berlin content cartography, ACM IMC (2011) 7

8 Content Hosting Analysis PAM 2018, Berlin 8

9 A look at the top ASes Observations Biased distribution: top 2 accounting for 2/3 ISPs dominate: not CDNs /cloud Good locality: ~70% queries resolved to IPs of the examined ISP Possible reasons ISPs provide IDC or even servers to CDNs for content replication Only ISPs and some giant enterprises have their own ASes in China PAM 2018, ISP Berlin is the one where we obtained data 9

10 CDP of Top ASes: popular domains The examined ISP 0.95 Apple Popular content is well replicated into the examined cellular ISPs Good for performance Apple AS: low CDP, but higher rank in terms of requests Host of its own services that are frequently requested (by smart devices) PAM 2018, Berlin 10

11 CDP of Top ASes: all domains Alibaba cloud ISP ISP Chinanet backbone Tencent Cloud CDP values for all ASes are relatively low (<0.06) Because of huge volume of non-popular domains The rise of cloud Cloud platforms provide easy-to-use hosting services for individuals 11

12 Content similarity between ASes Cosine Similarity One vector for each AS: an element is <domain name, # of queries> Chinanet: giant network Cloud very low similarity (hosting nonpopular sites) The examined ISP Low similarity: high content availability Exception: Akamai ASes (#12 and #13) ü caused by the domain aggregation? 12

13 CMI of Top ASes Top 10k domains low CMI values for all ASes All domains Very high for the two cloud platforms Moderately high for Chinanet s ASes PAM 2018, Berlin 13

14 On Content Providers Questions: who deployed the replicas into the cellular ISP? How about their network footprints? Identification of major providers WhoIs utility: not accurate Last CNAME: not available spectrum clustering on the bipartite graph Intuition: a provider uses a set of IP prefixes to serve same sites è clustering /24 IP prefix Domain Weighted by the # of queries seen IP prefixes 14

15 On Content Providers 15 out of 900+ clusters account for ~50% query volume Giant players in mobile Internet dominate, e.g. Baidu, Alibaba, and Tencent Mixed: may contain one or more CDNs 4 Tencent clusters provide 4 different services 15

16 (Invisible web) tracker hosting infrastructure PAM 2018, Berlin 16

17 A look at trackers Only 2 trackers are based in China a potential cyber-security vulnerability Trackers are well-replicated into several networks 17

18 Tracking server Bimodal distribution: either seldom used by tracking service, or exclusively for trackers Monitoring traffic goes to the servers that are exclusively for trackers could provide insights into trackers usage PAM 2018, Berlin 18

19 Tracking from the net perspective Trackers have also been replicated into the examined cellular network, but still 20% goes abroad Low CDP, low CMI trackers are replicated into several ASes, and each AS hosts very few 19

20 Summary One of the first studies on content hosting infrastructure in cellular network fromthe Chinese perspective Finding 1: great traffic localityin the examined ISP network Finding 2: raise of cloud platforms Finding 3: most of the popular trackers are non-china based Methodology: clustering over bipartite graph to infer providers On-going work Data: One ISP è all major ISPs, with CNAME being available Vision: an up-to-date picture of the content hosting infrastructure in China 20

21 Thanks PAM 2018, Berlin 21